Business.gov.nl
Logo of the Dutch government

Data breach

This information is provided by

Digital Trust Center

Does your company or organisation handle sensitive, protected, or confidential data? Always handle such data with care. Otherwise, the information may fall into the hands of third parties, intentionally or unintentionally . If sensitive data is copied, sent, viewed, stolen, or used by a person who does not have permission to do so, you are dealing with a data breach.

How does a data breach arise?

A data breach can occur as a result of a security vulnerability. This allows cybercriminals to gain access to computer files containing personal data, financial information, or trade secrets. Other examples of ways in which personal data inadvertently ends up in the hands of others include:

  • A business email sent to a wrong address;
  • Business laptops and USB sticks that are stolen or lost;
  • Discarded business computers, smartphones and tablets that are resold without being wiped clean.

Handling sensitive data

Many data breaches also arise because internal employees handle sensitive data carelessly. Or they are not aware that the information may be of interest to a third party. It is not possible to protect all information within your organisation. Make an inventory of sensitive information and handle it with care. Handling with care means, for example, not sharing the information with everyone in the organisation, and training the people who work with the data. When an employee is aware of the type of information they are working with and why it is important to handle it carefully, they are less likely to make mistakes or handle the data carelessly.

The GDPR

A data breach may also be a violation of the General Data Protection Regulation (GDPR). If it is, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, DPA) can impose a fine on your company or organisation.

Preventing a data breach

Naturally, you do not want your sensitive, protected, or confidential company data to be exposed. Keep company information safe and prevent it from being viewed or made public. The greater the awareness and the stricter the measures, the better. That way, if equipment is stolen or lost, the risk of business loss or a data breach is reduced. Here are some tips for preventing a data breach:

Do not collect (sensitive) information that you do not need

Collecting names, dates of birth, medical or financial data is made easy by various systems. But do you really need this data? Take a good look at whether the information you collect and store is relevant to your work and business processes.

Delete (sensitive) data you no longer need

The use of various systems usually means that information is stored automatically. You may be storing much more sensitive data than you actually need for your work. Take a good look at whether personal data of former customers, payment dates, or login details from the past are useful to store.

Consciously grant access to sensitive data

If it is necessary to give certain employees access to sensitive data. Think this through carefully in advance. Keep track of which employee has access to which type of information and if they need it to do their work.

Limit the number of places where you store sensitive data

If you are dealing with sensitive data, secure it well and store it in as few places as possible. You reduce the risk of unconscious data leaks if you store such information centrally, grant employees selective access, and keep track of which information is available to whom. Do not forget to make regular backups and to keep systems up-to-date.

Prevention software

Even when employees are well trained, mistakes can happen. In addition to a tight security mindset, you can also use Data Loss Prevention (DLP) software. DLP software detects potential data breaches by monitoring, detecting, and blocking sensitive data. For example, when using DLP software, you can classify and manage critical information. Unauthorised end users cannot accidentally or with malicious intent access or share data with third parties.

Hard drive encryption

Encrypt all data on laptop hard drives. This makes it difficult for thieves to view or disclose the data.

Two-step verification

Login using two-step verification or two-factor authentication (in Dutch). This means that in addition to a username and password, an extra step must be taken to log in successfully. For example a fingerprint. The second step can be based on a hardware or a software token. The latter can be done, for example, via a smartphone app.

Mobile Device Management

With Mobile Device Management, you can remotely block a mobile device and delete data if necessary. Depending on the type and brand of equipment, there are various options.

Policy

Set up a policy. Agree that data will not be stored locally on laptops and other devices. Try to enforce this technically as much as possible, by means of network and device policies. Use existing Secure Cloud Storage providers for data storage (with two-step verification login).

Other measures

The use of other security measures (in Dutch), such as regular pen-testing of software, antivirus and malware protection, strong passwords, and patching, can also reduce the risk of a data breach. But to keep data breaches to a minimum, it is crucial that employees are constantly trained and aware of the risks in order to keep data breaches to a minimum.

This information is provided by

Digital Trust Center
FAQPartnersContactAbout usDisclaimerPrivacy and cookiesAccessibilityOndernemersplein (Dutch)Business.gov.nl is an initiative of:Netherlands Chamber of Commerce, KVKNetherlands Enterprise Agency, RVOImmigration and Naturalisation Service, INDTax and Customs Administration, BelastingdienstGovernment.nlStatistics Netherlands, CBSNetherlands Vehicle Authority, RDWDigital Trust CenterEuropean Commission Point of Single ContactBusiness.gov.nl is the Dutch Point of Single Contact for entrepreneurs.Accessibility level: W3C WAI-AA WCAG 2.1